One might think that NADRA would exhibit the same diligence it does in issuing people an ID, which some argue is too cumbersome, in keeping the data that it asks for safe and secure. Well, you would be wrong. As it turns out, a JIT investigation report has revealed that the sensitive personal data of around 2.7 million Pakistanis has been stolen from NADRA’s database, specifically the Multan, Karachi and Peshawar offices. The report alleges that the stolen data was moved from Multan to Peshawar before being moved to Dubai, eventually being sold in Argentina and Romania. What makes all of this even more outrageous is that it happened over four years, not four weeks or months. How oblivious does an institution whose entire being is centred around issuing computerized identity cards have to allow for such a prolonged lapse in cybersecurity? The incident has led to disciplinary proceedings against several NADRA officers with eight already suspended and charged and over a dozen likely to be penalized. This includes the director general (DG) technical and DG network Karachi and at least one other senior management official.
What one wants with Pakistani data in far-off places is anybody’s guess but if identity theft is the motive the costs can be very high indeed. Unlike regular theft, one is not victimized once but in some cases over years. Someone is out there pretending to be you in the digital world, increasingly more real for most official purposes than the physical realm, while doing who knows what. They could be stealing money from your account or using your identity to commit more serious crimes in which you might become unwittingly implicated. Data is power in the digital age and such a large theft of citizen’s personal information also has implications for national security.
The criticism levelled at NADRA often revolves around the alleged inefficiency and cumbersome nature of its procedure. This issue is exacerbated by the fact that many Pakistanis lack the basic documentation that NADRA often asks for. This is unsurprising in a country where much activity, from property purchases to employment and even births in some cases, happens without any paper trail. While the net of official documentation has widened over the years this has not always been the case and, as such, it has been reported that around four per cent of adults residing in Pakistan still lack an official ID. This number disproportionately includes marginalized groups like refugees and women, depriving them of being able to fulfil the most basic tasks like opening a bank account, voting or getting a SIM. It was not until November 2021 that the absurd requirement of presenting a father’s ID card to get one’s own was removed by the courts, empowering children raised by single mothers. While one can now apply online for key documents like a CNIC, Pakistan is not exactly renowned for its digital literacy and internet penetration. However, as the official net widens, slow as it might be, it is becoming increasingly pertinent to ask what is happening with all the data that people are giving to the state. As of 2022 around 300 public and private service providers were reportedly able to access the CNIC database. If access to such databases is still as widespread, the regulations surrounding who has access and what they can do with the data need to be as stringent as possible.